JP7397655B2 - Automotive electronic control unit - Google Patents

Description

The present invention relates to an electronic control device for an automobile equipped with a multi-core processor.

In order to electronically control automobile engines, automatic transmissions, brakes, etc., a multi-core processor in which a plurality of processor cores are enclosed in one package is used, as described in Japanese Patent Application Laid-open No. 2009-215944 (Patent Document 1). An electronic control device for an automobile equipped with the above has been proposed. In such electronic control devices for automobiles, the application program that controls the controlled object is divided by function (processing) and the functions are distributed and assigned to multiple processor cores, thereby reducing the processing load and increasing parallel processing. This enables high-speed processing.

JP2009-215944A

However, if some of the processor cores in a multi-core processor fail, the functions assigned to that processor core can no longer be executed. I had to. If the limp home function controls the on-board equipment of a car, the drivability of the car deteriorates, making it impossible to accelerate, steady, and decelerate as intended by the driver.

SUMMARY OF THE INVENTION Therefore, an object of the present invention is to provide an electronic control device for an automobile that allows processing assigned to a multi-core processor to be executed by other processor cores even if a failure occurs in a part of the processor cores. shall be.

For this reason, in an automotive electronic control unit equipped with a multi-core processor, each processor core of the multi-core processor is assigned a process specific to the processor core and at least one process specific to other processor cores, so that the multi-core processor can operate normally. If so, each processor core of the multi-core processor executes its own processing. Furthermore, in an automobile electronic control device, if a failure occurs in some processor cores of a multi-core processor, other processor cores perform processing specific to the failed processor core. At this time, the processor core limits the processing that is being executed or to be executed if the number of proxy processes that are acting on behalf of other processor cores is equal to or greater than a predetermined number of processes.

According to the present invention, even if a failure occurs in some processor cores of a multi-core processor, the processing assigned to that processor core can be executed by other processor cores, so, for example, deterioration in the drivability of a car can be suppressed. can do.

FIG. 1 is a schematic diagram showing an example of an electronic control system installed in an automobile. FIG. 2 is an internal structure diagram showing an example of an electronic control device. FIG. 2 is an explanatory diagram showing the state of a dual-core processor during normal operation. FIG. 2 is an explanatory diagram showing the state of a dual-core processor at the time of failure. FIG. 2 is an explanatory diagram of a first monitoring method for mutually monitoring processor cores for abnormalities. FIG. 7 is an explanatory diagram of a second monitoring method for mutually monitoring processor cores for abnormalities. FIG. 7 is an explanatory diagram of a third monitoring method for mutually monitoring processor cores for abnormalities. FIG. 7 is an explanatory diagram of a fourth monitoring method for mutually monitoring processor cores for abnormalities. FIG. 2 is an explanatory diagram showing the state of a quad-core processor during normal operation. FIG. 2 is an explanatory diagram showing the state of a quad-core processor when a failure occurs in one processor core. FIG. 2 is an explanatory diagram showing the state of a quad-core processor when a failure occurs in two processor cores. FIG. 7 is an explanatory diagram of an example in which restrictions on proxy processing are unnecessary. FIG. 3 is an explanatory diagram of an example in which it is necessary to limit proxy processing; FIG. 7 is an explanatory diagram of another example in which restriction of proxy processing is unnecessary. FIG. 7 is an explanatory diagram of another example in which restriction of proxy processing is required. FIG. 7 is an explanatory diagram of another example in which restriction of proxy processing is required. FIG. 2 is an explanatory diagram of a first method of restricting execution of processing. FIG. 7 is an explanatory diagram of a second method of restricting execution of processing. FIG. 2 is an explanatory diagram showing the state of a pentacore processor during normal operation. FIG. 2 is an explanatory diagram showing the state of a pentacore processor when a failure occurs in one processor core. FIG. 2 is an explanatory diagram showing the state of a pentacore processor when a failure occurs in two processor cores. FIG. 3 is an explanatory diagram showing the state of a pentacore processor when a failure occurs in three processor cores. FIG. 2 is an explanatory diagram showing the state of an octa-core processor during normal operation to which the automotive functional safety standard is applied. FIG. 2 is an explanatory diagram showing the state of an octa-core processor when a failure occurs in one processor core in the ASIL area to which the automotive functional safety standard is applied. FIG. 2 is an explanatory diagram showing the state of an octa-core processor when a failure occurs in one processor core in the QM region to which the automotive functional safety standard is applied. FIG. 3 is an explanatory diagram showing the state of an octa-core processor when a failure occurs in one processor core in the ASIL region to which the automotive functional safety standard is applied. FIG. 3 is an explanatory diagram showing the state of an octa-core processor when a failure occurs in one processor core in the ASIL region to which the automotive functional safety standard is applied. FIG. 2 is an explanatory diagram showing the state of an octa-core processor when a failure occurs in all processor cores in the ASIL area to which the automotive functional safety standard is applied.

DESCRIPTION OF THE PREFERRED EMBODIMENTS Hereinafter, embodiments for carrying out the present invention will be described in detail with reference to the accompanying drawings.
FIG. 1 shows an example of an electronic control system installed in an automobile.

A vehicle 100 such as a truck, bus, passenger car, or construction machine has a plurality of electronic control units (ECUs) that electronically control a fuel injection device, an ignition device, an automatic transmission, an ABS (Antilock Braking System), an adaptive cruise control system, etc. It is equipped with 200. Each electronic control device 200 is connected to be able to exchange arbitrary data, for example, via an in-vehicle network 300 such as a CAN (Controller Area Network) or FlaxRay (registered trademark). Then, each electronic control device 200 electronically controls the controlled object independently or in cooperation with other electronic control devices 200. Although the illustrated automobile 100 is equipped with five electronic control devices 200, the number is not limited to five and can be any number.

The electronic control device 200 is equipped with a multi-core processor 220, as shown in FIG. The multi-core processor 220 has two processor cores 220A and a shared memory 220B shared by the two processor cores 220A. Here, the shared memory 220B can be a cache memory with excellent access speed. Further, the multi-core processor 220 is not limited to a dual-core processor having two processor cores 220A, but may have three or more processor cores 220A. Note that in the following description, the processor core 220A will be referred to as core N (N: a natural number of 1 or more).

First, an overview of this embodiment will be described with reference to FIGS. 3 and 4.
As shown in FIG. 3, processes 1, 3, and 5 specific to core 1 and processes 2 and 4 specific to core 2 are assigned to cores 1 and 2 of multicore processor 220, respectively. That is, all processes 1 to 5 to be executed as the multi-core processor 220 are assigned to cores 1 and 2, respectively. Therefore, cores 1 and 2 can execute any of processes 1 to 5. In the illustrated example, in a normal state where no failure has occurred in cores 1 and 2, core 1 executes processes 1, 3, and 5, and core 2 executes processes 2 and 4 in a distributed manner. Then, the cores 1 and 2 mutually monitor abnormalities using a monitoring method to be described later, and detect whether a failure has occurred in the monitored target.

When core 1 detects that a failure has occurred in core 2, as shown in FIG. In addition to 3 and 5, processes 2 and 4 specific to core 2 are executed. In this way, in the electronic control device 200, even if a failure occurs in some of the processor cores 220A of the multi-core processor 220, other processor cores 220A can execute the process assigned to that part on behalf of the other processor cores 220A. For example, deterioration in the drivability of the automobile 100 can be suppressed.

FIG. 5 shows a first monitoring method in which cores 1 and 2 mutually monitor for abnormalities.
The shared memory 220B of the multi-core processor 220 is provided with counters CNT1 and CNT2 specific to cores 1 and 2, respectively. Cores 1 and 2 count up counters CNT1 and CNT2, respectively, at regular intervals, and when the count values reach a predetermined value, reset counters CNT1 and CNT2. In addition, cores 1 and 2 monitor whether or not a counter specific to the core being monitored is changing, that is, core 1 monitors a change in counter CNT2, and core 2 monitors a change in counter CNT1. Cores 1 and 2 then diagnose that a failure has occurred in the cores if the monitored counters have stopped and have not changed. In this way, the occurrence of a failure can be detected without using peripheral devices such as an AD converter and a timer, and the resources of the electronic control device 200 can be saved.

FIG. 6 shows a second monitoring method in which cores 1 and 2 mutually monitor for abnormalities.
Cores 1 and 2 use the timer output function of multi-core processor 220 to output periodic pulses PLS1 and PLS2, respectively. In addition, cores 1 and 2 use the timer input function of the multi-core processor 220 to measure the period of the monitored pulse, that is, core 1 measures the period of pulse PLS2, and core 2 measures the period of pulse PLS1. Then, cores 1 and 2 diagnose that if the pulse output of the monitored core has stopped, that core is faulty, and if the pulse cycle of the monitored core is abnormal, the core is normal. However, it is diagnosed that the timer function is malfunctioning. In this way, although the timer function is used as a resource of the electronic control device 200, not only a core failure but also a failure of the timer function can be detected.

FIG. 7 shows a third monitoring method in which cores 1 and 2 mutually monitor for abnormalities.
Cores 1 and 2 use the port output function to output periodically changing ON/OFF signals (for example, 5V signal/0V signal) from analog output ports. Furthermore, the cores 1 and 2 use an AD function (analog-to-digital conversion function) to measure the voltage level of the ON/OFF signal output from the analog output port. Then, if the ON/OFF signal of the core to be monitored does not stop and change, cores 1 and 2 diagnose that the core is faulty, and change the voltage level of the ON/OFF signal of the core to be monitored. If it is abnormal (for example, 3.5V/0V), it is diagnosed that the core is normal but the AD function is malfunctioning. In this way, although the port output function and the AD function are used as resources of the electronic control device 200, not only a failure of the core but also a failure of the AD function can be detected.

FIG. 8 shows a fourth monitoring method in which cores 1 and 2 mutually monitor for abnormalities.
The cores 1 and 2 mutually transmit predetermined data using communication functions such as SCI (Serial Communication Interface), SPI (Serial Peripheral Interface), or CAN. Further, cores 1 and 2 use the communication function to receive data transmitted by the core to be monitored. Then, if cores 1 and 2 are not transmitting data from the monitored core and communication has stopped, they diagnose that the core is malfunctioning, and the data sent from the monitored core is abnormal. If so, it is diagnosed that the core is normal but the communication function is malfunctioning. In this way, although the communication function is used as a resource of the electronic control device 200, not only a failure of the core but also a failure of the communication function can be detected.

The multi-core processor 220 is not limited to a dual-core processor, but may be a quad-core processor having four processor cores 220A as shown in FIGS. 9 to 11.

In this case, core 1 to core 4 of the multi-core processor 220 have core 1 processing specific to core 1, core 2 processing specific to core 2, core 3 processing specific to core 3, and Core 4 processing specific to core 4 is assigned to each core 4. That is, all processes (core 1 processing, core 2 processing, core 3 processing, and core 4 processing) to be executed as the multi-core processor 220 are assigned to cores 1 to 4, respectively. Therefore, cores 1 to 4 can execute any processing among core 1 processing, core 2 processing, core 3 processing, and core 4 processing. In the illustrated example, in a normal state where no failure has occurred in cores 1 to 4, core 1 executes core 1 processing, core 2 executes core 2 processing, core 3 executes core 3 processing, Core 4 executes core 4 processing in a distributed manner. Then, cores 1 to 4 monitor the abnormalities of other cores in turn, that is, core 1 monitors the abnormality of core 2, core 2 monitors the abnormality of core 3, and core 3 monitors the abnormality of core 4. The core 4 monitors the core 1 for abnormalities.

When core 2 detects that a failure has occurred in core 3, as shown in FIG. In short, in addition to core 2 processing specific to core 2, core 3 processing specific to core 3 is executed. In addition, since a failure occurred in core 3 and it became impossible to monitor abnormalities in core 4, and there was no longer a need to monitor abnormalities in core 3, core 2 started monitoring abnormalities in core 4 instead of core 3. The monitoring route is reconfigured.

Afterwards, when core 2 detects that a failure has occurred in core 4, core 2, which was monitoring core 4 where the failure has occurred, executes the core 4 processing that was assigned to core 4, as shown in Figure 11. In short, in addition to core 2 processing specific to core 2 and core 3 processing specific to core 3, core 4 processing assigned to core 4 is executed. In addition, since a failure occurred in core 4 and it became impossible to monitor abnormalities in core 1, and there was no longer a need to monitor abnormalities in core 4, core 2 was changed to monitor abnormalities in core 1 instead of core 4. The monitoring route is reconfigured.

In this way, when a failure occurs in some of the processor cores 220A of the multi-core processor 220, the other processor cores 220A that have been monitoring the failure can perform the processing that was assigned to the processor core 220A in which the failure has occurred. Act on your behalf. Furthermore, the failure monitoring path for the processor cores 220A is reconfigured, and all processor cores 220A in which no failures have occurred are continuously monitored for abnormalities. Therefore, this embodiment is applicable not only to a dual-core processor but also to a multi-core processor 220 having three or more processor cores 220A, such as a quad-core processor, and can also be applied even if a plurality of processor cores 220A fail. You can understand that. Note that the failure monitoring path of the processor core 220A is not limited to the above path, and may be configured and reconfigured according to predetermined rules.

By the way, if a specific processor core 220A of the multi-core processor 220 performs processing that was assigned to another processor core 220A in addition to the processing that was originally assigned to it, the resource usage rate increases and control may fail. There is a risk that this may occur. Therefore, as will be described in detail below, when processing is delegated, the processing executed by the core may be limited to prevent control breakdown.

Here, in a normal state where no failure has occurred in cores 1 and 2 of the dual-core processor, core 1 executes processes 1, 3, and 5 specific to it, and core 2 executes processes 1, 3, and 5 specific to this, as shown in FIG. It is assumed that processes 2 and 4 specific to . In this state, for example, assume that the resource usage rate of core 1 is 70% and the resource usage rate of core 2 is 20%. Further, as a condition for limiting the processing to be executed, for example, the usage rate of the core resources is set to be 90% or more. It should be noted that the above-mentioned conditions for limiting are just examples, and are not limited to these values (the same applies below).

When a failure occurs in core 2, as shown in FIG. 13, core 1 performs processes 2 and 4, which are unique to core 2, in addition to processes 1, 3, and 5, which are unique to core 1. As a result, the usage rate of the resources of the core 1 becomes 70%+20%=90%, and if this continues, the control will break down, and it is necessary to limit the processing executed by the core 1.

The condition for limiting the processing executed by the processor core 220A is not limited to the resource usage rate of the processor core 220A, but may also be the number of substitute cores, that is, the number of substitute cores acting as other processor cores 220A; This may be applied further.

14 to 16 show other examples in which the multi-core processor 220 uses a triple-core processor having three processor cores 220A, and limits the processing executed by the processor cores 220A. Here, in a normal state where no failure has occurred in cores 1 to 3, as shown in FIG. It is assumed that processes 2 and 4 are assigned to each process. Further, it is assumed that the core 3 performs failure detection and proxy control for the cores 1 and 2. Note that as a condition for limiting the processing to be executed, for example, the number of proxy cores is set to be two or more, but is not limited to this.

When the core 3 detects that a failure has occurred in the core 2, the core 3 performs processes 2 and 4 specific to the core 2 on behalf of the core 2, as shown in FIG. In this case, the number of substitute cores for core 3 is 1, and the conditions for imposing a restriction do not hold, so processes 2 and 4 are executed without restriction. After that, when core 3 detects that a failure has occurred in core 1, core 3 performs processes 1, 3, and 4 that are unique to core 1, in addition to processes 2 and 4 that are unique to core 2, as shown in FIG. Act on behalf of 5. In this case, the number of substitute cores for core 3 is 2, and the condition for imposing a restriction is satisfied.

As shown in Figure 17, the first method of restricting the execution of processes is to set a priority for each process in advance, and stop the process sequentially starting from the lowest priority to reduce the resource usage rate. may be reduced. The illustrated example shows how to reduce the processing load on core N whose resource usage rate is 90% or more. When the resource usage rate reaches, for example, 95%, the process 100, which has the lowest priority among processes 1 to 100, is stopped. When process 100 is stopped, the resource usage rate drops from 95% to 93%, but since the resource usage rate is still over 90%, process 99, which has the lowest priority among processes 1 to 99, is It stops further. When process 99 is stopped, the resource usage rate drops from 93% to 91%, but since the resource usage rate is still over 90%, process 98, which has the lowest priority among processes 1 to 98, is It stops further. In this case, the resource usage rate decreases from 91% to 88%, and the conditions for limiting the processing to be executed no longer hold. Note that for the processes 98 to 100 whose execution has been stopped, for example, limp home control with reduced functions may be executed as necessary.

As a second method of restricting the execution of processing, the method shown in FIG. 18 may be used. That is, in controlling the automobile 100, as the engine speed increases, the number of interrupt processes that occur due to rotation speed synchronization increases, and as a result, the resource usage rate increases. Therefore, when the resource usage rate reaches a limiting threshold (predetermined threshold), the engine speed may be limited, for example, by reducing the fuel injection amount, reducing the throttle valve opening, or the like. In this case, as shown in the figure, by limiting the engine speed to the limiting threshold, the resource usage rate can be made less than the limiting threshold.

The multi-core processor 220 is not limited to a dual-core processor, triple-core processor, or quad-core processor, but may be a penta-core processor having five processor cores 220A as shown in FIGS. 19 to 22.

In this case, as shown in FIG. 19, one processor core 220A of the multi-core processor 220 is defined as a main core, and the remaining four processor cores 220A are distinguished as sub-cores 1 to 4. Then, the main core performs a process of detecting a failure in the sub-cores 1 to 4 and controlling their substitution. For this reason, the main core is assigned processes for detecting failures and performing proxy control. In addition, the main core and sub-cores 1 to 4 have core processing 1 specific to sub-core 1, core processing 2 specific to sub-core 2, core processing 3 specific to sub-core 3, and core processing 4 specific to sub-core 4, respectively. assigned. In a normal state where no failure has occurred in subcores 1 to 4, the main core monitors subcores 1 to 4 for abnormalities, subcore 1 executes core processing 1, and subcore 2 executes core processing 2. , subcore 3 executes core processing 3, and subcore 4 executes core processing 4.

When the main core detects that a failure has occurred in sub-core 2, as shown in FIG. In contrast, the sub-core 2 is made to perform the specific core processing 2 on behalf of the sub-core 2. After that, when the main core further detects that a failure has occurred in sub-core 3, as shown in FIG. Substitute. Furthermore, when the main core further detects that a failure has occurred in sub-core 1, the main core detects that the sub-core 1 has been executing the Performs processing 1 and core processing 2 on its own behalf. Note that the subcores 1 to 4 that execute proxy processing may be, for example, subcores with the lowest resource usage rate, instead of whether or not they are performing proxy processing.

By the way, as a concept of functional safety software design in an automobile electronic control device, there is a need to apply the automobile functional safety standard (ISO26262) regarding the functional safety of a plurality of modules that constitute an application program. In this case, some processor cores 220A of the multi-core processor 220 are used as an ASIL (Automotive Safety Integrity Level) area, and the remaining processor cores 220A are used as a QM (Quality Management) area where application of functional safety is not required. In this way, since the ASIL area and the QM area are allocated to different processor cores 220A, it becomes easier to ensure that the QM area does not infringe on the ASIL area, for example. When restricting access using the memory protection function, it is sufficient to permit only the core used as an ASIL to access the ASIL area.

23 to 28 show an example in which the multi-core processor 220 uses an octa-core processor having eight processor cores 220A (cores 1 to 8) and to which the automotive functional safety standard is applied. In the illustrated example, in a normal state where no failure has occurred in cores 1 to 8, cores 1 to 4 are used as the ASIL area, ASIL processing is assigned thereto, cores 5 to 8 are used as the QM area, Although QM processing is assigned here, it is not limited to this.

Cores 1 to 4 to which ASIL processing is assigned are assigned an access restriction that executes ASIL access restriction, and cores 5 to 8 to which QM processing is assigned are assigned an access restriction to execute QM access restriction. There is. In addition, cores 1 to 8 have processing to execute delegated control, processing to detect failures of other cores through mutual monitoring, ASIL processing 1 to 4 specific to cores 1 to 4, and QM specific to cores 5 to 8. Processes 1 to 4 are assigned respectively. Here, the reason why QM processes 1 to 4 are assigned to cores 1 to 4 and ASIL processes 1 to 4 are assigned to cores 5 to 8 is because, for example, if all cores 1 to 4 or 5 to 8 fail. This is to enable cores 5 to 8 or 1 to 4 to execute proxy processing when this occurs. In the normal state, as shown in FIG. 23, core 1 executes proxy control, and cores 1 to 8 execute failure detection and specific ASIL processing or QM processing.

When it is detected that a failure has occurred in core 3 in the ASIL area, as shown in FIG. Among them, the core 4 with the lowest resource usage rate is made to perform ASIL processing 3 specific to the core 3 on behalf of the core 4. Note that whether or not a failure has occurred can be detected using any of the first to fourth monitoring methods described above.

Subsequently, when it is detected that a failure has occurred in core 5 in the QM area, as shown in FIG. QM processing 1 specific to core 5 is performed on behalf of core 6, which has the lowest resource utilization rate among cores 6 to 8. After that, when it is further detected that a failure has occurred in core 1 in the ASIL area, as shown in FIG. Of the cores 2 or 3 in the area, the core 2 with the lowest resource usage rate performs ASIL processing 1 specific to the core 1 on behalf of the core 2 or 3 of the area.

Furthermore, when it is detected that a failure has occurred in core 2 in the ASIL area, as shown in FIG. ASIL processes 1 and 2 that were being executed by ASIL 2 are performed on behalf of ASIL processes 1 and 2. At this time, if the resource usage rate in core 4 has not reached the limit threshold, but the resource usage rate exceeds the limit threshold, the process will be processed sequentially starting from the lowest priority according to the preset priority order. The engine may be stopped or the engine speed may be limited. Note that it is preferable to perform the restriction based on the resource usage rate when performing proxy control.

If another failure occurs in core 4 in the ASIL area in this state, there will be no more cores in the ASIL area to execute ASIL processes 1 to 4. In this case, as shown in FIG. 28, the ASIL area is allocated to core 7, which has the lowest resource usage rate among cores 5 to 8 in the QM area, so that ASIL processes 1 to 4 can be continuously executed. At this time, the QM process 3 that was being executed by the core 7 is delegated to the core 6, which has a lower resource usage rate among the cores 6 and 8 in which no QM area failure has occurred.

Therefore, even if a part of the plurality of processor cores 220A is used as an ASIL area and the remaining part is used as a QM area, it is possible to deal with various failures. Further, since the ASIL area and the QM area are assigned to different processor cores 220A, there is no need to change access restrictions even if a failure occurs, and it is possible to suppress the program structure from becoming complicated.

It should be noted that those skilled in the art will understand the technical ideas of the various embodiments described above by omitting some of them, combining some of them as appropriate, or replacing some of them with well-known techniques. It will be readily understood that various embodiments can be created.

For example, when the multi-core processor 220 has three or more processor cores 220A, the above embodiment may be applied to some of the processor cores 220A, and the remaining processor cores 220A may be used in the conventional manner.

In addition, the conditions for limiting the processing executed by the processor core 220A are not limited to the resource usage rate and the number of proxy cores, but also the number of proxy processing, that is, the number of processor cores 220A that performs processing on behalf of other processor cores 220A. This may also be applied further. In this case, each process that was being executed by the failed processor core 220A may be performed by one processor core 220A, or by a plurality of processor cores 220A working together.

100 Automobile 200 Electronic control unit 220 Multi-core processor 220A Processor core

Claims (6)

An automotive electronic control device equipped with a multi-core processor,
A process specific to the processor core and at least one process specific to another processor core are assigned to each processor core of the multi-core processor, and if the multi-core processor is normal, each processor core of the multi-core processor Each processor core executes a process specific to the processor core, and if a failure occurs in some processor cores of the multi-core processor, another processor core performs the process specific to the processor core in which the failure has occurred ,
The processor core limits the process being executed or to be executed when the number of proxy processes that are acting as a proxy for the processes of other processor cores is equal to or greater than a predetermined number of processes;
Automotive electronic control equipment. The processor core limits the process being executed or to be executed if the resource usage rate becomes a predetermined value or more when the process is performed on behalf of the processor core.
The automotive electronic control device according to claim 1. The processor core limits the processing being executed or to be executed when the number of substitute cores acting on behalf of other processor cores is greater than or equal to a predetermined number of cores;
An electronic control device for an automobile according to claim 1 or 2. The restriction of the processing is performed by setting a priority order for each process in advance, and sequentially stopping the processing from the lowest priority order.
An electronic control device for a motor vehicle according to any one of claims 1 to 3 . The processing is limited by limiting the engine speed to a predetermined threshold;
An electronic control device for a motor vehicle according to any one of claims 1 to 3 . Processing related to ASIL of the automotive functional safety standard and processing related to QM are assigned to different processor cores.
An electronic control device for an automobile according to any one of claims 1 to 5 .